diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index c54e347d2..aea283e5c 100755
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -4682,19 +4682,19 @@ static void hci_sched_le(struct hci_dev *hdev)
 {
 	struct hci_chan *chan;
 	struct sk_buff *skb;
-	int quote, *cnt, tmp;
+	int quote, cnt, tmp;
 
 	BT_DBG("%s", hdev->name);
 
 	if (!hci_conn_num(hdev, LE_LINK))
 		return;
 
-	cnt = hdev->le_pkts ? &hdev->le_cnt : &hdev->acl_cnt;
+	cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
 
-	__check_timeout(hdev, *cnt, LE_LINK);
+	__check_timeout(hdev, cnt, LE_LINK);
 
-	tmp = *cnt;
-	while (*cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
+	tmp = cnt;
+	while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
 		u32 priority = (skb_peek(&chan->data_q))->priority;
 		while (quote-- && (skb = skb_peek(&chan->data_q))) {
 			BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
@@ -4709,7 +4709,7 @@ static void hci_sched_le(struct hci_dev *hdev)
 			hci_send_frame(hdev, skb);
 			hdev->le_last_tx = jiffies;
 
-			(*cnt)--;
+			cnt--;
 			chan->sent++;
 			chan->conn->sent++;
 
@@ -4719,7 +4719,12 @@ static void hci_sched_le(struct hci_dev *hdev)
 		}
 	}
 
-	if (*cnt != tmp)
+	if (hdev->le_pkts)
+		hdev->le_cnt = cnt;
+	else
+		hdev->acl_cnt = cnt;
+
+	if (cnt != tmp)
 		hci_prio_recalculate(hdev, LE_LINK);
 }